What is Video Forensics?

Video Forensics or is the scientific examination, comparison and/or evaluation of video in legal matters. This definition has been adopted by accredited video forensic agencies around the country and internationally such as LEVA, NATIA as well as IAI. The video forensic process must be performed in a forensic lab that is equipped with the appropriate tools and follows best practice protocols in order to process the video recording with integrity and accuracy.

Three Categories of Video Forensic Scientists:

Technician: Intake of the evidence, copies and converts media, performs preliminary enhancements and other assessments.

With the rapid proliferation of surveillance cameras in public and private places, video forensic experts and law enforcement agencies are increasingly making use of these recordings as evidence. Fixed and mobile digital video recorders and other portable video recording CCTV systems are making it easier to capture surveillance/crime scene video that may later be used as evidence in court. Playback of these video recordings is some time difficult. We help make it easier for the Trier of Fact.

Digital video evidence is most commonly created by passive and active recording systems. A passive recording system is a recording system that doesn’t store information in its memory system. An active recording system would be one that stores information in its memory system. Active recording systems are most commonly produced with a digital storage medium such as a HDD, SSD or Volatile (flash) memory system. Video recorders create digital video recordings in these types of formats:

Open source format: An open format is a file format for storing digital data, defined by a published specification usually maintained by a standards organization, and which can be used and implemented by anyone.

Proprietary format: A proprietary format is a file format of a company, organization, or individual that contains data that is ordered and stored according to a particular encoding-scheme, designed by the company or organization to be secret, such that the decoding and interpretation of this stored data is easily accomplished only with particular software or hardware that the company itself has developed. These formats are more common when video evidence is extracted directly from the system that created it, because they are a more secure and higher quality formatting. These proprietary formats also contain digital information like Meta Data and Telemetry Data that can assist a video forensic technician, video forensic analyst as well as video forensic expert in their investigation.

Courtroom ready format: A copy of the video recording that is easily playable in a court of law using a computer, projection system, or large television. This is most commonly a digital format today and should be tested on the system that it will be played through prior to presentation to the court. Often times the copy of the recording is deliverable in the form of a flash drive, DVD or Data Disc. Although the playable copy will be encoded in a common video format (MP4, AVI, WMV) it still may require a freeware player like VLC player or DVD playback software to advance frames as well as play or decode smoothly.

Acquisition of Video Evidence

It is often necessary for a forensic technician, analyst or video forensic expert to perform a digital video evidence recovery in order to secure the Digital Media Evidence for analysis. DME (Digital Media Evidence) is defined by LEVA as “Information of probative value stored in binary form” (LEVA-2013). CCTV surveillance video recordings are the most common type of digital media evidence (DME). Once the recordings have been secured, an accurate chain of custody can be presented to the trier of fact. In addition, the forensic expert that acquired the video evidence can ensure that the highest quality versions of the recording are obtained so that a successful forensic video enhancement or forensic image comparison can be performed.

Most fixed and mobile Digital Video Recorder (DVR)-based surveillance systems employ proprietary computer operating systems and record digital video to proprietary formats. Under these circumstances, causing minimal degradation of picture quality during the process of recovering and trans-coding video files is a complex challenge for both law enforcement agencies and video forensic experts. There are a wide variety of surveillance system manufacturers and an even wider number of models of DVRs, which requires the video forensic expert to prepare for ahead of time and acquire the appropriate tools necessary to recover the recording accurately and efficiently.

In addition, the video forensic expert must follow protocols set forth by the scientific community in order to ensure that the processes used for video evidence recovery are systematic and admissible in a court of law. Video Forensic Expert recommends that every video expert prepare a forensic recovery kit that would include I/O cabling, storage mediums in varying sizes, a cloning device, video camera equipment, write blocker, evidence bags in order to be prepared for the various recovery situations from the various CCTV digital video and mobile video recorders.

Creating a disc image (clone) of the DVR’s hard drive is the most common first step in the evidence recovery protocol to protect the probative information stored in the system’s volatile and non-volatile memory. The technician must understand the file system structure on the primary and slave drive before performing a disc image or forensic clone.

Lab Investigation

Forensic Image Comparison Investigation

The Forensic Image Comparison investigation is the process of comparing digital images, or digital images extracted from video recordings to determine the probability that the people or objects depicted in these images are the same or different. The Forensic Image Comparison investigation is most accurate when the images or videos are of sufficient quality, and they meet the forensic comparison criteria.

It is considered that the most prolific source of evidence for police investigations are from video recordings. Video Forensics tells us that all video recordings are not an accurate medium because digital compression removes information and adds information that wasn’t originally included. It is because of these reasons that a Video Forensic Expert MUST be able to interpret the images and video recording in order to present the events as they occurred and compare these and analyze the results.

Because of the unreliability of images and video presented as evidence, a Video Forensic Expert MUST also be able to qualify the events to ensure that the people or objects presented has sufficient detail and pixel information for an accurate forensic image comparison investigation. In some cases, when the objects or people displayed are not clear, we perform a forensic video enhancement in order to see the details of the images more clearly for an accurate comparison.

Video Clarification/Enhancement

The objective of Forensic Video Enhancement is to clarify or enhance the events as they occurred. This is done using non destructive techniques to preserve the video evidence integrity, and pixel quality. Clarifying or enhancing the events as they occurred assists the Trier of Fact to weigh the video evidence and its relevance to the litigation. As video forensic expert, we are often asked to enhance CCTV Surveillance video recordings for court. We are also asked to provide video image enhancement for identification purposes. We create customized filtering to sharpen the video image and remove video noise for identification and enhancement of the images in the CCTV Surveillance video.

Below are some of the most popular clarification and enhancement techniques that can be applied to an investigation.

Forensic enhancement and analysis tools include software and hardware that are implemented and used on a powerful desktop computer. Methods applied to this scientific examination must be executed in a systematic and accurate nature. Our video forensics service is sought after by law enforcement agencies, attorney’s, government agencies and private clients. Opinions and conclusions drawn by the video forensic expert MUST follow best practices. A forensic report is created on completion that exhibits all activity performed in the lab as well as forensic processes performed. That way, any other qualified video forensic expert can follow our steps multiple times and establish the same conclusions and opinions. Our video forensic processes and executed with the utmost accuracy as we testify in court on our opinions and conclusions.

Video Analysis/Authentication

Forensic video analysis and authentication is the scientific processes performed by a trained video forensic expert in order to determine events that occurred at the time of the video recording. CCTV cameras do not see the same as the human eye. Some of the video recordings we examine in our lab have been altered either with malice or unintentionally using processes that alter the integrity of the evidence. As video forensic experts we help our client attorneys understand any anomalies in the video recording we are asked to analyze and perform several scientific tests to determine the nature of any anomalies.

Expert Witness Testimony

What is a Video Forensic Expert Witness?

A Video Forensic Expert has the scientific knowledge, training and expertise necessary to enhance and authenticate video recordings that are being used in a criminal or civil court case. The expert witness has previous court room experience testifying and helps the Trier of Fact understand the video evidence that is offered in a litigation.

If you have a video that you question or need help understanding, please contact us for a pro bono conversation. We apply our forensic expertise to cases in the United States and many countries around the globe. Any and all formats of audio and video accepted. Retainer agreement available on request; travel expenses will be quoted in advance excluding meal expenses and flat rate time for travel instead of hourly.